Twitter bans obvious passwords

An applause for Twitter which has recently made it so that when you sign up for an account you can't use one of those very obvious passwords.

Here is a list of the passwords (courtesy of The Wundercounter)

So, if you currently use passwords which resemble any of those listed, I would encourage you to change them as soon as possible.

Researchers Prepare Practical Demonstration Of GSM Encryption Cracking Technology

GSM calls can be intercepted and decoded using low-cost hardware and open-source software, researchers say.

Security researchers Karsten Nohl and Chris Paget presented their findings in a presentation (WMV video) Monday at the 26th Chaos Communication Congress (CCC) in Berlin. A practical demonstration of the vulnerabilities and potential exploits is scheduled to take place at the conference on Wednesday at 12:00 GMT.

The demonstration is a follow-up to a presentation the two researchers made in August at the Hacking At Random conference, during which they outlined serious flaws in the GSM encryption scheme.

GSM is used in approximately 80 percent of the world's mobile communications systems, and in about 3 billion cell phones across the globe, according to industry estimates. In his CCC presentation yesterday, Nohl pointed out that much data has already been published about GSM's vulnerabilities, but the pair's new research takes it one step further -- by showing how GSM calls can be intercepted and decoded using relatively low-cost hardware and open-source software that is readily available on the Web.

Organizations should assume that within six months of the demo GSM phone calls will be at risk, says Stan Schatt, vice president and practice director for healthcare and security at ABI Research.

For full report, read here.

Phishers prefer Paypal, Visa, eBay and Amex

Compared to the first half of 2009, the amount of phishing messages has remained relatively unchanged, although phishers have switched their focus to institutions that could bring them the most profit in the shortest timeframe. This is one of the results of BitDefender's malware and spam survey.

Primary targets are PayPal, Visa and eBay, followed by HSBC, American Express and Abbey Bank. Ally Bank and Bank of America rank last with a little over one percent of the total amount of phishing messages. These messages mostly target English-speaking computer users who are using the services of at least one of the institutions previously mentioned.

BitDefender Labs found that most web 2.0 phishing attempts in the first half of 2009 relied on social engineering schemes and speculated user naivety. The Twitter Porn Name scam is a good example. Users were invited to reveal their first pet name, as well as the first street on which they lived. These names are usually employed as backup/security questions. An e-crook possessing a person’s username along with these “clues” can easily retrieve a password that he or she can later employ to access the account and send spam, access transactions, or use the account in whatever way necessary to make a profit, including demanding a ransom for release of the hijacked account.

“2009 witnessed a wide range of security threats aiming at both end-users and at corporate networks,” Vâlceanu commented. “Extra caution and a highly-rated antimalware solution with antispam, antiphishing and antimalware modules are a must-have for anyone surfing the web in 2010.”

(Not So) Happy Holidays from Koobface

New variants of Koobface are emerging that attempt to trick Facebook users in to downloading fun images or gifts, associated with the holiday season. Please be careful on all social networks as they are very popular and a target for malware writers and criminals to take advantage of folks.

Extract from report:
"Activities associated with Koobface have increased during the month of December. This morning we noticed a trend with some of the domain-based locations making use of the holiday theme. This has included everything from “presents for your pets” to “festive holiday trees” – these are domains that appear legitimate but are not.

When users go to these sites for these happy holiday thoughts – they are instead instantly greeted by having files downloaded to their computers. And voila – a lovely “gift” is attempting to execute upon them. The gift of holiday identity theft!"

Facebook Hit By Clickjacking Attack

Facebook is cleaning up after a clickjacking attack that infiltrated the social networking site this week -- and security experts say this won't be the last such attack.

Clickjacking, in which an attacker slips a malicious link or malware onto a legitimate Web page that appears to contain normal content, is an emerging threat experts have been warning about.

The attack on Facebook was in the form of a comment on a user's account with a photo that lured the victim to click on it.
The embedded link took the victim to a Web page that presented like a CAPTCHA or Turing test, and asked the user to click on a blue "Share" button on the Facebook page. (as shown below)
Once clicked, the victim is redirected to a YouTube video, and then the same post shows up on the victim's account and thus tries to infect his or her friends. Security experts say the attack appeared to be more of a prank or trial balloon, and it affects only Firefox and Chrome browsers, according to security expert Krzysztof Kotowicz, who blogged about the attack this week.

Facebook has now blocked the URL to the malicious site, fb.59.to.

Full reports here and here.

Twitter attacker had proper credentials

If the earlier report about Twitter's DNS being compromised was bad enough, I guess this would emphasize the severity of the threat.

While Twitter has remained largely quiet on the hour-long hijacking of its domain name, additional information suggests that the attacker had compromised at least one user at the social networking company.

On Thursday, an unknown attacker hijacked Twitter's domain name and redirected visitors to an unrelated site hosting a page claiming Twitter had been hacked by the "Iranian Cyber Army." Evidence indicates, however, that the attackers were able to change the domain-name system (DNS) entries at Twitter's provider, Dyn Inc., said Rod Rasmussen, president and CEO of Internet Identity, an infrastructure security firm which monitors DNS changes.

"First of all the name servers themselves didn't change, so someone was updating things at the provider," Rasmussen said. Because other clients were not showing signs of DNS hijacking, it's unlikely that Dyn itself had been breached, Rasmussen said. "We didn't see anything else at Dyn that indicated signs of that the service had been compromised."

On Friday, Dyn confirmed that the attacker had the proper credentials to log into Twitter's account with the company and change the addressed assigned to various hosts in the Twitter.com domain. While some media reports have called the attack a hack or a defacement against the site, neither term applies, said Kyle York, vice president of sales and marketing for the firm.

"From our point of view, no unauthenticated users logged into the system," York said.

Adobe PDF Reader - Zero Day JavaScript attacks circulating in the wild

Please be careful with all PDF files, keep AV protection updated, and look for future Adobe releases which will address this issue. I usually keep JS off unless it's required to fill out a PDF form.

Adobe PDF Reader - Zero Day attack circulating
http://www.adobe.com/support/security/advisories/apsa09-07.html
http://www.avertlabs.com/research/blog/index.php/2009/12/16/another-adobe-reader-zero-day-take-care/

QUOTE: Adobe has confirmed a critical vulnerability in Adobe Reader and Acrobat 9.2 and earlier versions that could cause a crash and potentially allow an attacker to take control of the affected system. There are reports that this vulnerability is being actively exploited in the wild. Adobe recommends customers follow the mitigation guidance below until a patch is available

HOW TO DISABLE JAVASCRIPT IN ADOBE READER:

Customers can mitigate the issue by disabling JavaScript in Adobe Reader and Acrobat using the instructions below:

1. Launch Acrobat or Adobe Reader.
2. Select Edit>Preferences
3. Select the JavaScript Category
4. Uncheck the 'Enable Acrobat JavaScript' option
5. Click OK

Twitter investigates DNS hijack

Twitter, the popular micro-blogging network, welcomed visitors on Thursday night with a page claiming that the site had been hacked by a defacers with links to Iran.

In reality, the company's domain name had been hijacked by the vandals and visitors redirected to an unrelated site hosting the page. Passive domain-name service (DNS) records showed the DNS poisoning, as Twitter's record pointed first to two domains registered in Moldova and then to a domain registered to an undisclosed person in Pompano Beach, Florida, according to information posted by the SANS Internet Storm Center.

Twitter acknowledged the issue late last night, following earlier media reports.

Defacement was claimed to be done by the "Iranian Cyber Army," but another message -- translated from Farsi by Google's automated translation engine -- reportedly claimed the attack was motivated by the U.S. and Twitter's interference in "my country," suggesting the attacker was an individual.

There's No Such Thing as a Free Movie

Those looking to see the latest 3D blockbuster movie, The Avatar, on the cheap will have to take great care in what they search for. We have become aware of at least one site that has been rigged to redirect users to a page that presents the now-familiar "play video/need codec" screen. In an unusual twist, this time it is offering a new ActiveX update rather than the usual codec or Flash player updates.

Read on to see what new tricks these scammers have up their sleeves.

Koobface Botnet - New Christmas Theme

Facebook and other users of web 2.0 social networks should be careful and avoid unusual messages or spammed comments on their sites, and a new variant of the Koobface worm is circulating with a Christmas based theme.

The Koobface botnet, one of the most efficient social engineering driven botnets, is entering the Xmas season with a newly introduced template spoofing a YouTube video page, in between enticing the visitor into installing a bogus Adobe Flash Player Update (New Koobface campaign spoofs Adobe’s Flash updater), which remains one of the most popular social engineering tactics used by the botnet master

Full report here:
http://blogs.zdnet.com/security/?p=5001

Bit.ly steps up security

Bit.ly, one of the most popular URL shortening services, announced it will be integrating three new security-related services by the end of the year:

1. Websense's ThreatSeeker Cloud security-as-a-service solution - to analyze and categorize the Web sites and content behind millions of shortened bit.ly URLs created daily to protect end users from "spammy URLs, malicious content and phishing sites."

2. VeriSign’s iDefense IP reputation service - to detect malware and "blacklist URLs, domains, and IP addresses which host exploits, malicious code, command and control servers, drop sites and other nefarious activity."

3. Sophos' security service - to identify malware and spam by using behavioral analysis.

Very good news, indeed!